Privacy Policy

1.Who the controller is

The data controller is [IME I PREZIME VLASNIKA], [ADRESA]. For any question about your data, write to [EMAIL].

Processing is governed by the Law on Personal Data Protection of the Republic of Serbia (Official Gazette RS, No. 87/2018) and, for users in the European Union, by the General Data Protection Regulation (GDPR).

2.What data we collect

We collect only what you enter or what is created while you use the app:

• Account: email address, your name if you add it, language, theme, time zone and settings.
• Training profile: sex, year of birth, goal, experience, where and with what equipment you train, how many days a week and for how long, your chosen days and your diet type.
• Training and progress: your plan, completed workouts, logged sets, reps and loads, challenges, levels and points.
• Health data (a special category of data): height, body weight and measurements, health questionnaire answers, injuries and complaints, safety warnings you report during a workout, data about pregnancy, the postpartum period and menopause, food allergies, meals eaten, hydration, energy expenditure estimates and the runs or walks you log, as well as a record of the consents you have given (version and time).
• Subscription: Lemon Squeezy’s customer and subscription identifiers, your chosen plan, status and dates (trial, renewal, cancellation) and the notifications Lemon Squeezy sends us about these changes. We never see or store your card details.
• Technical data: IP address and request time in server logs, and a record of sign-in attempts (email and IP address) to protect against abuse.

3.Health data — only with explicit consent

We process health data only on the basis of your explicit consent (Art. 9(2)(a) GDPR and Art. 17(2)(1) of the Serbian Law on Personal Data Protection), which you give during onboarding before you enter it. Without this data the plan cannot be safely adapted to you, so without consent we cannot build a plan.

You can withdraw your consent at any time by deleting your account in your profile or by writing to [EMAIL]; we then delete all your health data. Withdrawal does not affect the lawfulness of processing before it.

We keep health data separately from other data. We never use it for ads or marketing, never sell it and never share it with anyone.

4.Why we process data and on what basis

Your plan is put together by an algorithm based on your answers. This is not a decision with legal effects on you within the meaning of Art. 22 GDPR — you can always change the plan or not use it.

• Creating and running your account and building your training and nutrition plan — performance of a contract (Art. 6(1)(b) GDPR).
• Adapting the plan to your health, age and stage of life — explicit consent (section 3).
• Managing your subscription and handling refund requests — performance of a contract.
• Sending sign-in codes and important account and subscription notices — performance of a contract. We do not send marketing emails.
• Protecting the service from abuse and attacks (limiting sign-in attempts, server logs) — legitimate interest (Art. 6(1)(f) GDPR).

5.Where the data is stored

Data is stored on our own server ([SERVER LOCATION]), in a Supabase database that we run ourselves (self-hosted) — not with an external database provider. Access is restricted at the database level: every user can see only their own data.

The connection to the site is encrypted (HTTPS). Traffic to the server passes through Cloudflare’s network, which technically processes your IP address and request data in transit; Cloudflare has no access to the database.

6.Who else sees the data

We do not sell data or share it with advertisers. Only providers the service cannot run without have access, and only to what they need:

• Lemon Squeezy (Sold through Link, LLC, formerly Lemon Squeezy LLC) — authorised reseller (Merchant of Record) and payment processor. Sees what you enter at checkout (such as your email, country and card details) and processes it under its own privacy policy. Lemon Squeezy does not see your plan or your health data.
• Email provider (Loopia) — we use it to send sign-in codes and notices; it sees your email address and the content of that email.
• Cloudflare — the network that carries traffic to the server (section 5).
• Public authorities — only where the law expressly requires it.

7.Transfers outside Serbia and the EU

Lemon Squeezy (and its payment processor Stripe) and Cloudflare may process data outside Serbia and the European Union, using the safeguards described in their privacy policies. Your app data (plan, training, health data) stays on our server.

8.How long we keep data

• Account, profile, training and health data are kept for as long as your account exists.
• When you delete your account, all of this data is deleted from the database immediately. Database backups are overwritten within [BACKUP RETENTION PERIOD].
• Server logs are kept for [SERVER LOG RETENTION PERIOD].
• Payment records are kept by Lemon Squeezy as the seller, for the periods the law requires.

9.Your rights

For any request, write to [EMAIL]. We reply without undue delay and within 30 days at the latest. At any time you have the right to:

• find out what data we hold about you and get a copy;
• download your data in a machine-readable format (JSON) — the export button is in your profile;
• correct inaccurate data — most of it you can edit directly in the app;
• delete your account and all data — the button is in your profile;
• ask us to restrict processing, or object to processing based on legitimate interest;
• withdraw your consent for health data (section 3);
• lodge a complaint with the Serbian Commissioner for Information of Public Importance and Personal Data Protection (www.poverenik.rs) or with the supervisory authority of the EU country where you live.

10.Cookies and local storage

We use only what the site needs to work. There are no advertising cookies, no analytics and no tracking tools — which is why there is no consent banner.

• Sign-in session cookies (Supabase) — keep you signed in.
• The mf_locale cookie — remembers your language.
• Browser local storage (theme) — remembers your theme and is never sent to the server.
• When you open checkout, Lemon Squeezy may set its own cookies needed for secure payment and fraud prevention.

11.Age

Moja Forma is for people aged 16 and over. We do not knowingly collect data from younger people; if we learn that an account was opened by someone under 16, we delete it together with all its data.

12.Security

We protect your data with an encrypted connection, database-level access control (every user sees only their own rows), separate storage for health data and password-free sign-in. No system is completely secure; if a data breach puts you at risk, we will notify you and the competent authority as the law requires.

13.Changes to this policy

If we materially change this policy, we will tell you by email or in the app before the change takes effect. If the change affects what your consent covers, we will ask for it again.

14.Contact

[IME I PREZIME VLASNIKA], [ADRESA]. Email: [EMAIL].